Idelvo backs up your Okta configuration, tracks every change back to the person who made it, compares tenants, and audits for risky settings. It runs on your own infrastructure and only ever reads from Okta.
| Field | Before | After |
|---|---|---|
| complexity.minLength | 12 | 6 |
| complexity.dictionary.common.exclude | true | false |
Okta shows you how things are today. Idelvo keeps how they were, who changed them, and whether they're safe.
Users, groups and group rules, apps and assignments, policies and rules, authenticators, network zones, device assurance and more, synced on a schedule. Every change is kept as a version, with a field-by-field diff and point-in-time JSON export.
The Okta System Log is collected continuously and kept well beyond Okta's 90 days. Each change Idelvo detects shows who made it, and every object shows the events that touched it. Filter by actor, target, event type and outcome.
Compare production with preview, or any of your tenants. Objects are matched by what they are, not by ID, and references are compared by name, so you see real configuration drift instead of noise.
More than 50 built-in rules, evaluated after every sync, with thresholds you can tune and rule packs you can write yourself.
See who holds admin roles and how they're protected, and what can reach your Okta APIs.
Findings reach you by email or webhook (Slack, Teams or JSON), as one digest per audit, never repeated. Accept a finding with a reason and an expiry, and it stays quiet. The tool's own audit log streams to your SIEM.
A built-in MCP server lets assistants such as Claude answer questions like "who changed our MFA policy last week?" from your data. Access uses personal tokens that can't exceed your role, and nothing it does can change Okta.
Register production, preview and development orgs side by side. Switch between them, compare them, and keep each one's history and findings separate.
Idelvo isn't a SaaS. You run it next to your other tools, and your Okta configuration and logs never leave your environment.
Create a read-only service app in each Okta org and register it in Idelvo. Idelvo checks which read scopes Okta granted and turns on what it can collect.
The first sync takes a full snapshot and backfills the System Log Okta still holds. After that, configuration syncs on a schedule and the log is polled about every minute.
Browse history, see who changed what, compare tenants and work through findings. Alerts tell you when something new needs attention.
No. It connects with read scopes only, and no feature writes to Okta. Actions in Idelvo, such as accepting a finding or starting a sync, only change Idelvo itself.
No. You run it on your own server or cloud account with Docker Compose. Your configuration, System Log and findings stay in your database, and nothing is sent to us.
Configuration versions are kept indefinitely. System Log events are kept for 13 months by default, configurable per tenant, including forever.
Today, Idelvo shows every earlier version of an object, field by field, and exports snapshots as JSON, so you can see exactly what to put back. It never writes to Okta itself.
Yes. Rules are short YAML files with conditions written in CEL. You can tune the built-in rules' thresholds in the app, turn rules off, or load your own rule packs.
Idelvo is in active development. Join the interest list and we'll let you know when it's ready to try.
Leave your email and we'll tell you when Idelvo is ready. We'll only use it for news about Idelvo, and you can ask us to remove it at any time.